Line to take - LTT59 - Fair Processing Notices

• FOI/EIR: FOI, EIR
• Section/Regulation: s40, reg 13
• Issue: Fair Processing Notices
• Source: Information Tribunal
• Details: Baker / House of Commons (16 January 2007)
• Related Lines to Take: LTT56, LTT57, LTT163, LTT165
• Related Documents: EA/2006/0015 and EA/2006/0016, FS50072319, FS50071194, Awareness Guidance 1
• Contact: RM / HD
• Date: 21/01/2010
• Policy Reference: LTT59
• © Copyright Information Commissioner's Office, re-used with permission
• Original source linked from here: LTT

Line to take

The fact that data subject has not been advised that certain personal data may be disclosed under the Act does not in itself render the disclosure unfair.

Further Information

Schedule 1, part 1 states:

“Personal data shall be processed fairly and lawfully……”

In broad terms, for the processing of personal data to be considered fair, a data subject should be informed of the identity of the data controller, the intended purpose(s) for which the data is to be processed as well as any other information relevant to the specific data subject and/or the circumstances of the case. This is set out in Schedule 1, part II, paragraph 2(3) of the DPA.

Where personal data is obtained directly from the data subject, paragraph 2(1) requires a data controller to provide a data subject with the fair processing information at the time the information is collected, so far as is practicable.

The first case that dealt with fair processing cases was the case of the House of Commons v ICO & Norman Baker MP. The House of Commons argued that disclosing additional information in relation to MPs’ travelling expenses under FOI involved processing the information for a fresh purpose which MPs had not been advised about and so the processing would be unfair. Whilst this is an unusual case, the Tribunal rejected the argument that the disclosure was unfair because MPs had not been advised that additional information could also be released. The Tribunal found that simply because a public authority fails to advise that other disclosures were possible does not mean a disclosure is unfair otherwise a disclosure that in all other respects was fair “could effectively be blocked by the data controller (…) arranging data collection in such as way as to render the disclosure unfair”. para 76.

However in most cases it is less likely that the data controller/public authority could anticipate personal data being requested under the Act and the personal data in question may even have been collected before the Act was in force.

It is the Commissioner’s general rule that the details contained in a fair processing notice should concern the business purposes of the data controller/public authority. The Commissioner does not consider compliance with FOI requests as being a business purpose of a public authority. Therefore omitting to mention disclosures under the Act in a fair processing notice would not in itself mean a disclosure would contravene the DPA. In such cases compliance would be determined by a more general consideration of the fairness element of the First Principle.

Casework example – Successful University Applications Details (FS50110885)

The complainant sought information concerning successful applicants to the University of Cambridge broken down by school/college, gender and course. The public authority advised that the data subjects were informed that their personal data would only be processed for the following purposes: (a) to collect statistics or monitor equal opportunities (or both); (b) for research purposes, but no information which could identify them as an individual will be published; and (c) the information provided will normally be treated as confidential.

The Commissioner found that whilst the data subject’s expectations would be shaped by the fair processing notice, he did not believe that a specific notification of a disclosure under the FOIA was necessary. The Commissioner instead found that disclosure would be fair because there are many circumstances where an individual would disclose details of the University course they studied i.e. applying for a job. Also the Commissioner did not believe that there would be any detriment to the data subject via disclosure and thus found that disclosure would be fair.